Schneier on Security

Clive Robinson • May 30, 2019 2:09 AM

@ Ross Snider,

Moderation communities seem promising to me, but I usually find moderators are staffed with incentives and tools that don’t quite make for the moderation best for the community.

Moderating communities is always going to be hard.

For instance see comments just today,

https://www.schneier.com/blog/archives/2019/05/alex_stamos_on.html#c6793380

https://www.schneier.com/blog/archives/2019/05/alex_stamos_on.html#c6793391

This thread is not about (party politics) or (idiot politicians) yet those two commenters who have not made a constructive comment to this thread (or in one case ever on this blog under that handle) think it’s OK to derail the thread entirely.

Ironically they breach one set of rules designed to keep a thread on topic yet make complaint about the rules…

But they don’t see or I guess want to see why that might be an issue for others… Which is an issue psychologists have a number of names for, because it’s actually quite common.

Over the millennia as society has developed, rules and sanctions have developed for what some call the “meatspace” or tangible, physical world and how people behave in it. Technology has given us the Internet and opened up “infospace” considerably more rapidly than society can react thus rules and sanctions are few to none.

Our host @Bruce even after having nearly had his blog trashed by extremism and partisan political venom and rhetoric dressed up as faux patriotism, is still more tolerant of “party propaganda” type comment than many would be. For which many are grateful, myself included, and for which he should be commended.

Unfortunatly security especially ICT Security is becoming not just broader in scope, due to the many very public failings it’s had, it’s no longer a “nerd only domain”. Mainly this is because of the very real effect it’s having on the everyday citizen. After all ask yourself of the aproximately 330million Americans in the world, how many have not been effected directly or indirectly by the failings of ICT Security?

Thus the ICT Sec tent has become too interesting and very noticeable, thus the “Camel’s nose” of “political interest” has forced it’s self through the ICT Sec tent flap. And like “toppsie’s cat” where ever it goes trouble is soon to follow. That is inevitable as part of the human condition, or if you prefer “just the way it is”.

Thus the question arises of how you manage the intrusion that the Camel’s Nose is? Beating it with a stick will only rile the beast up to the point it brings down further trouble if not the whole tent. The trick is to make the beast more intetested in other things, thus it will lose interest and hopefully find another tent more interesting. Unfortunately ICT Sec or more correctly those that employ it badly are still making lots of interest for the Camel.

Worse yet is that main stream politicians now see ICT as their way to “reach the people” in their usual totally inept way thus like children who despite being warned of the danger play with fire and not unexpectedly not just get burnt but immediately want to blaim others for their stupidity and petulance, and such behaviour is more catching than the common cold.

But others are more adept at using the technology in a more focused way. With any thing that is new that has few or no rules and sanctions, the worst of the worst form the exploiting vanguard, closely followed by other scheming opportunists. For some reason we are encoraged to think of politics as a simple line with a moderate center and extream ends. Unfortunatly it is a way way to simple model and has little contact with reality.

Thus you can have those who are allegedly politically moderate behaving in extream ways and happy to make use of not just the scheming opportunists but also the worst of the worst, who realy should have no place in polite society. In the past whilst such people existed their power was relatively small due to the lack of resources they had available to them and that they were frequently sanctioned. Thus their resource were limited and they could not access the same “force multipliers” others more acceptable to society could.

As I’ve pointed out a number of times in the past the tangible physical world can be viewed as a subset of the intangible information world. That is there are constraints in the tangible world that don’t apply in the information world. I’ve also pointed out that being creatures of the tangible world most people make assumptions based on physical world interaction that are not true in the information world.

The example I use from time to time is that of the “distance costs” assumption subconsciously built into economic ideas that gives rise to the notion of competitive markets. When “distance costs”, making your market coverage larger has significant costs which means you have to charge more for your tangible goods the further they are from the point of production. Thus somebody starting making similar products has in effect a competative advantage in their place of production (all other things being equall). Thus with “distance costs” several players can give rise to a market place where choice is available to consumers thus realistic competition is possible. The same is not true of information services where moving data has no distance cost to either the service provider or their customers thus you end up not with a market but a “first to market is the market winner”. All others can do is create a different market for themselves, due to other effects these different markets get either absorbed or destroyed by those with older markets.

The result is you end up with just a handfull of very massive force multipliers with effectively zero cost of use open to anyone with out any effective rule or sanction…

Thus the worst of the worst and scheming opportunists now have little or no cost to enter the game. Thus we have seen the rise of the “first in market” effect promote the extreamists.

The owners of these force multiplying services do not want the trapings of the more traditional tangible goods markets, which due to history work within a lot of rules that they can not avoid. That is the force multiplier owners do not want the rules we more normally call regulation and legislation. Which at the end of the day are very much designed to ensure market players behave responsibly towards their customers.

Currently those who own these force multiplying services are trying to buy two forms of rules. Ones that mean they can make more money/profit/influence/power, and ones that keep others out of what they see as their domain in various ways.

One aspect of this behaviour is that they want to avoid being seen as publishers which incures all sorts of responsabilities but as “common carrier” communications providers which have effectively no responsability thus liability for what people use their infrastructure for. In reality the force multiplier service providers are with little doubt publishers by the very basic way they opperate[1].

The problem for the force multiplier owners is that as they “publish for everyone” at no direct charge, they can not aford to moderate the billions of articles they actually publish.

Whilst people have argued about the figures one thing that has come out of the congressional enquires into the Russian Factory output is that it is a fantastically small fraction of the traffic. Whilst not in the same league as the proverbial drop in the ocean, it is way to much information to be seen and evaluated conciously by humans, not just in real time but at all. Which is why it mostly does not get consciously seen (something the Advert industry knows only too well but won’t admit to).

Thus those who own the force multipliers can not survive if they become regulated as publishers. Thus they have entered a devils pact with politicians. They will look only for and stop what the politicians don’t want to have their attention drawn to…

This they can do by somewhat simplistic rules in software and by banning those they get complaints about. Thus it does not nor can not reflect what a moderate community would wish for.

[1] Common Service providers provide a “point to point” service not a “broadcast service”. To get the “common service” status you traditionally had to promise “privacy of service” that is the old “Must not see, thus can not see, thus can have no responsibility for content” argument. A broadcaster is actually a publisher, they have no choice but to see what it is they are duplicating to multiple points of delivery, thus they have responsibility for what they broadcast no matter if it’s stone tablets from on high through all writen and communicable forms even if it is from down in the gutter (and people wonder why I don’t have a blog…).

Clive Robinson • June 1, 2019 8:45 AM

@ George,

This appears plausible but it’s unrealistic in the real world.

Don’t fall into the same assumption trap as economists and many others.

By “real world” do you mean the “tangible/physical” subset of the “intangible/information” world, or something else?

Looking onwards you appear to be talking about “physical world” effects on an organisation that produces “informational goods”.

Thereby you are accidently conflating physical world constraints on an informational world market.

To see the problem think about the making of cement or refining of metals, the cost of production varies depending on where you production is located by zoning. However once produced there is generally no zoning on where you can ship cement or refined metals from or to. Thus production has little or no effect on the cost of distribution of the goods which is where the “distance cost” metric arises.

Remember “production” is not a “market” and thus should be treated seperately, because it’s the selling, buying and distribution of the finished goods that is the market.